Computer and data communications networks continue to proliferate due to declining costs, increasing performance of computer and networking equipment, and increasing demand for communication bandwidth. Communications networks—including wide area networks (“WANs”) and local area networks (“LANs”)—allow increased productivity and utilization of distributed computers or stations through the sharing of resources, the transfer of voice and data, and the processing of voice, data and related information at the most efficient locations. Moreover, as organizations have recognized the economic benefits of using communications networks, network applications such as electronic mail, voice and data transfer, host access, and shared and distributed databases are increasingly used as a means to increase user productivity. This increased demand, together with the growing number of distributed computing resources, has resulted in a rapid expansion of the number of installed networks.
As the demand for networks has grown, network technology has grown to include many different physical configurations. Examples include Ethernet, Token Ring, Fiber Distributed Data Interface (“FDDI”), Fibre Channel, and InfiniBand networks. These and the many other types of networks that have been developed typically utilize different cabling systems, different bandwidths and typically transmit data at different speeds. In addition, each of the different network types have different sets of standards, referred to as protocols, which set forth the rules for accessing the network and for communicating among the resources on the network.
However, many of the network types have similar characteristics. For the most part, digital data are usually transmitted over a network medium via frames (also referred to as “data frames” or “data packets”) that can be of a fixed or a variable length. Typically, data frames have headers and footers on the two ends of the frame, and a data portion disposed in the middle. The specific layout of these data frames is typically specified by the “physical layer protocol” of the network being used. For example, the Ethernet physical layer protocol specifies that the structure of a data frame include a preamble field, a six-byte destination address field, a six-byte source address field, a two-byte type field, a data field having a variable size (46-1,500 bytes), and a four-byte error checking field. Other physical layer protocols will specify similar types of frame layouts.
As is well known, transmissions from one network connected device to another device are typically passed through a hierarchy of protocol layers. Each layer in one network connected device essentially carries on a conversation with a corresponding layer in another network connected device with which the communication is taking place and in accordance with a protocol defining the rules of communication.
For example, one well-known protocol standard is the Open Systems Interconnection (OSI) Model. OSI defines a seven-layer protocol model, which is widely used to describe and define how various vendors' products communicate. In that model, the highest network layer is the Application Layer. It is the level through which user applications access network services. The next layer is the Presentation Layer which translates data from the Application Layer into an intermediate format and provides data encryption and compression services. The next layer is referred to as the Session Layer, which allows two applications on different network connected devices to communicate by establishing a dialog control between the two devices that regulates which side transmits, when each side transmits, and for how long. The next layer, the Transport Layer, is responsible for error recognition and recovery, repackaging of long messages into small packages of information, and providing an acknowledgement of receipt. The next layer is the Network Layer, which addresses messages, determines the route along the network from the source to the destination computer, and manages traffic problems, such as switching, routing and controlling the congestion of data transmissions.
It is the next layer, referred to as the Data Link Layer, which packages raw bits into the logical structured data packets or data frames, referred to above. This would correspond, for example, to the Ethernet physical layer protocol noted above. This layer then sends the data frame from one network connected device to another. The lowest layer in the hierarchal model is the Physical Layer, which is responsible for transmitting bits from one network connected device to another by regulating the transmission of a stream of bits over a physical medium. This layer defines how the cable is attached to the network interface card within the network connected device and what transmission techniques are used to send data over the cable.
Thus, as a message is passed down through each of these respective layers, each layer may add protocol information to the message. Thus, the “data” present within the data payload of the data frame at the Data Link Layer (e.g., the Ethernet data frame) typically comprises a protocol stack comprised of multiple message packets. Each message packet has its own protocol format, and it may in turn be embedded within the data payload of another higher layer message, also having a different protocol.
As communication networks have increased in number and complexity, the networks have become more likely to develop a variety of problems, which are in turn more and more difficult to diagnose and solve. For example, network performance can suffer due to a variety of causes, such as the transmission of unnecessarily small frames of information, inefficient or incorrect routing of information, improper network configuration and superfluous network traffic, to name just a few. Such problems are compounded by the fact that many networks are continually changing and evolving due to growth, reconfiguration and introduction of new network typologies and protocols as well as new interconnection devices and software applications.
Consequently, diagnostic equipment, commonly referred to as “network protocol analyzers,” have been developed for capturing, analyzing, and displaying information about data frames that are transmitted over a network. Typically, protocol analyzers are designed to identify, analyze and resolve interoperability and performance problems in different networks typologies and protocols. For example, the equipment enables users to perform a wide variety of network analysis tasks, such as counting errors, filtering frames, generating traffic and triggering alarms.
To do so, a protocol analyzer typically has the capability to capture all of the physical layer data frames (packets) generated by other stations (nodes) on the network. The analyzer is then designed to evaluate the contents of each data frame and, preferably, display the contents along with a meaningful description, and preferably in the sequence in which they were captured from the network. The analysis data that can be displayed with each captured data frame can include a variety of information, including the time at which the packet was captured, the length of the packet, packet address information for one or more protocol layers, and a set of protocol decodes at each layer that the protocol analyzer is capable of decoding.
Typically, the number of data frames captured by the network analyzer is quite large, sometimes numbering in the millions and billions. To help analyze all this data, various capture viewing software tools have been developed to aid the user. A typical usage of the capture viewing software tools is to search for a specific protocol field value in all the frames of a capture. For example, in a capture of SCSI traffic over Fibre Channel, it is typical to isolate all the frames for a specific LUN (SCSI Logical Unit Number) value.
One common software tool simply searches for a specific protocol field at a fixed byte offset location in all the captured data frames. For example, if a user desired to search for a LUN field value of 0x0000 at byte offset 28, the user would input this into the software as a search field. The software would then cause all the captured data frames to be searched for the value of 0x0000 at byte offset 28 whether the data frames were SCSI Command frames or not. The returned values typically would include many false positives as any data frame with the value of 0x0000 at byte offset 28 would be returned, even if the frames did not contain a LUN value. Accordingly, this method is very fast, but not very accurate.
Another common software tool decodes every data frame one-by-one and isolates only those data frames with the desired field. For example, if a user desired to search for a LUN field value of 0x0000, the user would input this into the software as a search field. The software would then cause every data frame to be searched one-by-one. Only those data frames with a LUN field value of 0x0000 would be returned. However, searching each and every data frame may take hours for a large number of frames. Accordingly, this method is very accurate, but also very slow.